-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathUserLIst.au3
29 lines (23 loc) · 978 Bytes
/
UserLIst.au3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#Include <Security.au3>
$list = ProcessList()
For $i = 1 to $list[0][0]
ConsoleWrite($list[$i][0] &" : "& _GetProcessUser($list[$i][1]) & @CRLF)
Next
Func _GetProcessUser($PID)
$WTS_PROCESS_INFO= "DWORD SessionId; DWORD ProcessId; PTR pProcessName; PTR pUserSid"
$aDllRet=DllCall("WTSApi32.dll", "bool", "WTSEnumerateProcesses", "Dword", 0, "Dword", 0, _
"Dword", 1, "ptr*", DllStructGetPtr($WTS_PROCESS_INFO), "Dword*", 0)
Local $mem, $aProc[$aDllRet[5]][4]
For $i=0 To $aDllRet[5]-1
$mem=DllStructCreate($WTS_PROCESS_INFO, $aDllRet[4]+($i*DllStructGetSize($mem)))
$aProc[$i][1]=DllStructGetData($mem, "ProcessId")
$aSid = _Security__LookupAccountSid(DllStructGetData($mem, "pUserSid"))
If IsArray($aSid) Then $aProc[$i][3] = $aSid[0]
Next
For $i=0 to UBound($aProc) - 1
if $aProc[$i][1] = $PID Then
Return $aProc[$i][3]
EndIf
Next
DllCall("WTSApi32.dll", "int", "WTSFreeMemory", "int", $aDllRet[4])
EndFunc